CVE-2013-1665

2013-02-1900:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.5%

JSON

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in
OpenStack Keystone Essex and Folsom, Django, and possibly other products
allow remote attackers to read arbitrary files via an XML external entity
declaration in conjunction with an entity reference, aka an XML External
Entity (XXE) attack.

Bugs

Notes

Author	Note
jdstrand	Keystone on 11.10 is a pre-release version and unusable with other components such as nova and horizon

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchkeystone< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.5UNKNOWN
ubuntu12.10noarchkeystone< 2012.2.1-0ubuntu1.2UNKNOWN
ubuntu10.04noarchpython-django< 1.1.1-2ubuntu1.8UNKNOWN
ubuntu11.10noarchpython-django< 1.3-2ubuntu1.6UNKNOWN
ubuntu12.04noarchpython-django< 1.3.1-4ubuntu1.6UNKNOWN
ubuntu12.10noarchpython-django< 1.4.1-2ubuntu0.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	keystone	< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.5	UNKNOWN
ubuntu	12.10	noarch	keystone	< 2012.2.1-0ubuntu1.2	UNKNOWN
ubuntu	10.04	noarch	python-django	< 1.1.1-2ubuntu1.8	UNKNOWN
ubuntu	11.10	noarch	python-django	< 1.3-2ubuntu1.6	UNKNOWN
ubuntu	12.04	noarch	python-django	< 1.3.1-4ubuntu1.6	UNKNOWN
ubuntu	12.10	noarch	python-django	< 1.4.1-2ubuntu0.3	UNKNOWN